dcrat | 0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
Size

1.5MB
MD5

0df291ae9e609cac23830f6de938b7cb
SHA1

c06389fb7b9f176c118ec7e95df56344b9e9a61b
SHA256

0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db
SHA512

d9918ba91ac67c3bb3e795e22c8f3ae67226ca119217d54a41724d9f0622765f99c609af192e78343bb1921c919b81322a58f449061b1167dc85d3c22088adea
SSDEEP

24576:9bfESdvMj6hoGDAQsJ+N6XcHQWq3QY2SrXQLdok0OjYS4mej+T1kJCv:5Ei6GDAQORcwW5/oBjme81

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat 14 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2740	schtasks.exe
		2624	schtasks.exe
		2692	schtasks.exe
		2172	schtasks.exe
		2764	schtasks.exe
		2804	schtasks.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\wininit.exe		0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
		2092	schtasks.exe
		2812	schtasks.exe
		2584	schtasks.exe
		2796	schtasks.exe
		2828	schtasks.exe
		2220	schtasks.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\56085415360792		0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\wininit.exe\""	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\""	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Install\\Idle.exe\""	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	1624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	1624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	1624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	1624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	1624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	1624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	1624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	1624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	1624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	1624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	1624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	1624	schtasks.exe	30

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
396	powershell.exe
1488	powershell.exe
776	powershell.exe
1560	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1132	Idle.exe
3000	Idle.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\WmiPrvSE.exe\""	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Google\\Update\\Install\\Idle.exe\""	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\wininit.exe\""	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\56085415360792	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
File created	C:\Program Files (x86)\Google\Update\Install\Idle.exe	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
File created	C:\Program Files (x86)\Google\Update\Install\6ccacd8608530f	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\RCXAE4A.tmp	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\RCXB261.tmp	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\Idle.exe	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\wininit.exe	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\wininit.exe	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2740	schtasks.exe
2584	schtasks.exe
2092	schtasks.exe
2692	schtasks.exe
2220	schtasks.exe
2828	schtasks.exe
2804	schtasks.exe
2624	schtasks.exe
2172	schtasks.exe
2764	schtasks.exe
2796	schtasks.exe
2812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
396	powershell.exe
776	powershell.exe
1488	powershell.exe
1560	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	1132	Idle.exe
Token: SeDebugPrivilege	3000	Idle.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1488	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	43
PID 2524 wrote to memory of 1488	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	43
PID 2524 wrote to memory of 1488	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	43
PID 2524 wrote to memory of 776	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	44
PID 2524 wrote to memory of 776	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	44
PID 2524 wrote to memory of 776	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	44
PID 2524 wrote to memory of 1560	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	45
PID 2524 wrote to memory of 1560	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	45
PID 2524 wrote to memory of 1560	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	45
PID 2524 wrote to memory of 396	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	46
PID 2524 wrote to memory of 396	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	46
PID 2524 wrote to memory of 396	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	46
PID 2524 wrote to memory of 1908	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	51
PID 2524 wrote to memory of 1908	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	51
PID 2524 wrote to memory of 1908	2524	0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe	51
PID 1908 wrote to memory of 2628	1908	cmd.exe	53
PID 1908 wrote to memory of 2628	1908	cmd.exe	53
PID 1908 wrote to memory of 2628	1908	cmd.exe	53
PID 1908 wrote to memory of 1132	1908	cmd.exe	55
PID 1908 wrote to memory of 1132	1908	cmd.exe	55
PID 1908 wrote to memory of 1132	1908	cmd.exe	55
PID 1132 wrote to memory of 2452	1132	Idle.exe	56
PID 1132 wrote to memory of 2452	1132	Idle.exe	56
PID 1132 wrote to memory of 2452	1132	Idle.exe	56
PID 1132 wrote to memory of 2920	1132	Idle.exe	57
PID 1132 wrote to memory of 2920	1132	Idle.exe	57
PID 1132 wrote to memory of 2920	1132	Idle.exe	57
PID 2452 wrote to memory of 3000	2452	WScript.exe	58
PID 2452 wrote to memory of 3000	2452	WScript.exe	58
PID 2452 wrote to memory of 3000	2452	WScript.exe	58

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe
"C:\Users\Admin\AppData\Local\Temp\0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\Install\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jBNXXH4ecd.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2628
- - C:\Program Files (x86)\Google\Update\Install\Idle.exe
    "C:\Program Files (x86)\Google\Update\Install\Idle.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a938a83-5b14-4238-a7ff-6f1c7968be0d.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2452
    - - C:\Program Files (x86)\Google\Update\Install\Idle.exe
        
        "C:\Program Files (x86)\Google\Update\Install\Idle.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3000
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b45b324-2c6b-4fe7-ab3e-ab7aa24982a4.vbs"
      4⤵
      PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rUGDwininit" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "oBobwininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "iaGzwininit" /sc ONSTART /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WpfjWmiPrvSE" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fvYFWmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AJL2WmiPrvSE" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rW9EIdle" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Update\Install\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1YTTIdle" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Install\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "J54tIdle" /sc ONSTART /tr "'C:\Program Files (x86)\Google\Update\Install\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Update\Install\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\Install\Idle.exe

Filesize
1.5MB

MD5
29e9d6d2065d9917b72bb3fddd81e974

SHA1
586f2a635fc05a05706a3afc347176b972ff9d11

SHA256
00e42bc7b0789f5f50288ab1700bd981867b7d8a3ee3183340db320841090f9c

SHA512
b1e7c83ba9d31b1e126e59b297026c582ae9ac7c7100e66ca28d9068e6a4582ba84e9891d10e07b2bf853b004a464e9885f78e445a35b33afab55fbda80cdf0f

Download Submit
C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\wininit.exe

Filesize
1.5MB

MD5
0df291ae9e609cac23830f6de938b7cb

SHA1
c06389fb7b9f176c118ec7e95df56344b9e9a61b

SHA256
0fbb8a353ed94e2a696c2fb72a9d5d1bcc24210bb8537a38fdf67cd60817a2db

SHA512
d9918ba91ac67c3bb3e795e22c8f3ae67226ca119217d54a41724d9f0622765f99c609af192e78343bb1921c919b81322a58f449061b1167dc85d3c22088adea

Download Submit
C:\Users\Admin\AppData\Local\Temp\3a938a83-5b14-4238-a7ff-6f1c7968be0d.vbs

Filesize
729B

MD5
6d9793d4df5b1f5e26ed3b3e23fcfaee

SHA1
bcc29f0d7b8554ac9a21023d7701698c80e8249c

SHA256
ee69558df0f9e90fb3e957eb5fbaac25108a003876d2a0af451a14d0cb3f2117

SHA512
3da87f5b68e45e0f59bb8b2595ffe13df4eef43213a1e33eadb5e60be645c2e05a79a4eca8df22cfe2d0d81c3da091a7df0b4be2a5a473d3f5eb78bcd62c536f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3b45b324-2c6b-4fe7-ab3e-ab7aa24982a4.vbs

Filesize
505B

MD5
04922154a5f03e34ad1b5b84ab4f8d41

SHA1
5ae2b099ed6f2a59e5fa304bc7ba33f2c7df24c5

SHA256
9314f28603124a489e4e4fff4b56c690bd778b30d2234d997691ec93e8d87d24

SHA512
01c3751e5cc14cfc76912a784c1775c2c209e19aa0d8d910ee5e2748e539de0ab2f90b1b73028b0d38bb1af778476c440f71da5059c6a036416203b9324cb339

Download Submit
C:\Users\Admin\AppData\Local\Temp\jBNXXH4ecd.bat

Filesize
217B

MD5
82612ca468303e30fea35c81d5470eba

SHA1
cf2b0dcabb5843e6c723d2fcfdcfca88b54060d5

SHA256
bef4c1c7ad878f394c9432320e2fba6811e160fcf5e965166f1cae1394f6c7e8

SHA512
09c4115f41cbd7cd9d4cd5d26a0e993911f3056ea498c84c9557507e8e392ea3be6b8aa44508d96ab06a50f8d445e658bab6e35c2a15d3bcc990f7e252504cf7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
57674f1293da4bbab1b4c84f9d3eb398

SHA1
c774d50f46a275897ea5e20d0cd4af9c48d1d668

SHA256
98ed6251eff9a1f950e2ffddcc363652574ac9163f4ce536425a4fd8b52f30f3

SHA512
a6c45f06aebf2f50f8107f87432785fb6bdfc3e6e43afe73e654118110f1353570a852ea79af82f77d86432863b7ebbf95988da45a792228401cbb31c49d98d7

Download Submit
memory/396-65-0x0000000002710000-0x0000000002718000-memory.dmp

Filesize
32KB

Download
memory/396-63-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/1132-73-0x0000000000370000-0x0000000000382000-memory.dmp

Filesize
72KB

Download
memory/1132-72-0x0000000000AB0000-0x0000000000C3C000-memory.dmp

Filesize
1.5MB

Download
memory/2524-6-0x0000000002110000-0x0000000002122000-memory.dmp

Filesize
72KB

Download
memory/2524-8-0x0000000002120000-0x000000000212C000-memory.dmp

Filesize
48KB

Download
memory/2524-12-0x0000000002170000-0x000000000217A000-memory.dmp

Filesize
40KB

Download
memory/2524-13-0x0000000002180000-0x000000000218C000-memory.dmp

Filesize
48KB

Download
memory/2524-10-0x0000000002150000-0x000000000215A000-memory.dmp

Filesize
40KB

Download
memory/2524-9-0x0000000002140000-0x000000000214C000-memory.dmp

Filesize
48KB

Download
memory/2524-56-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-11-0x0000000002160000-0x000000000216C000-memory.dmp

Filesize
48KB

Download
memory/2524-7-0x0000000002130000-0x0000000002140000-memory.dmp

Filesize
64KB

Download
memory/2524-0-0x000007FEF5393000-0x000007FEF5394000-memory.dmp

Filesize
4KB

Download
memory/2524-5-0x0000000000720000-0x0000000000730000-memory.dmp

Filesize
64KB

Download
memory/2524-4-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/2524-3-0x0000000000940000-0x000000000095C000-memory.dmp

Filesize
112KB

Download
memory/2524-2-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-1-0x0000000000060000-0x00000000001EC000-memory.dmp

Filesize
1.5MB

Download